fittings-lunar-moon-times

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set contains a direct-download JavaScript module (https://fittings.sh/skill/call.mjs) with explicit curl+run instructions, which is a high-risk pattern for untrusted executable distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs fetching and executing a remote script (curl -sO https://fittings.sh/skill/call.mjs followed by node call.mjs), so https://fittings.sh/skill/call.mjs is a runtime-fetched dependency that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a paid API flow that requires signing an authorization with an on-chain wallet/private key (FITTINGS_PRIVATE_KEY), mentions holding USDC on Base, and provides a client (call.mjs) and EVM-related libraries (@x402/evm) to perform the payment signing. Those are specific crypto payment actions (wallet signing/spending) rather than generic tooling, so the skill grants direct financial execution capability.